Policy Statement of the Federal Trade Commission on Education Technology 
and the Children’s Online Privacy Protection Act 


The Federal Trade Commission (““Commission’’) is committed to ensuring that education 
technology (“ed tech’) tools and their attendant benefits do not become an excuse to ignore 
critical privacy protections for children. When Congress enacted the Children’s Online Privacy 
Protection Act! (“COPPA”), it empowered the Commission with tools beyond administering 
compliance with notice and consent regimes. The Commission’s COPPA authority demands 
enforcement of meaningful substantive limitations on operators’ ability to collect, use, and retain 
children’s data, and requirements to keep that data secure. The Commission intends to fully 
enforce these requirements—including in school and learning settings where parents may feel 
they lack alternatives. 


Protecting children’s privacy online has been a priority for the Commission since 1998, 
when the Commission recommended “that Congress develop legislation placing parents in 
control of the online collection and use of personal information from their children.”” Thereafter, 
Congress enacted COPPA and charged the Commission with enforcing the law, entrusting the 
FTC to take the lead in protecting children’s privacy just as the country was entering the Internet 
age. To implement COPPA, the Commission issued the COPPA Rule, which became effective in 
2000. 


In the decades since COPPA’s enactment, there has been a steady proliferation of 
technologies that allow, and business models that depend on, the online collection and 
monetization of consumers’ personal information. The development of ever more sophisticated 
targeting practices, in some cases based on comprehensive collection of users’ activities across 
the Internet, has raised concerns that businesses might engage in harmful conduct and led to calls 
for strengthening children’s privacy protections. Partly in response to these concerns, the 
Commission revised the COPPA Rule‘ in 2013, including to hold third parties such as 
advertising networks liable for collection of children’s personal information from child-directed 
sites in violation of the Rule° and to expand the definition of personal information to include 


'15 U.S.C. §§ 6501-6505. 

? FED. TRADE COMM’N, PRIVACY ONLINE: A REPORT TO CONGRESS, at 42 (June 1998). See also Complaint, In re 
Liberty Fin. Cos., Inc., FTC File No. 982-3522 (Aug. 12, 1999)(alleging that website operator falsely represented 
that personal information collected from children in a survey would be maintained anonymously and that 
participants would be sent an e-mail newsletter and prizes); Complaint, In re GeoCities, FTC File No. 982-3015 
(Feb. 5, 1999) (alleging that website operator misrepresented which entity collected and maintained personal 
identifying information collected from children). 

316C.F.R. Part 312. As discussed below, the Commission strengthened the COPPA Rule through amendments that 
became effective in 2013. See Children’s Online Privacy Protection Rule, 78 Fed. Reg. 3,972 (Jan. 17, 2013) (Final 
Rule amendments codified at 16 C.F.R. Part 312). 

4 See id. 

5 See id. at 4,010. See also Complaint, United States v. OpenX Techs., Inc., Case No. 2:21-cv-09693 (C.D. Cal. Dec. 
15, 2021) (alleging that online advertising platform collected and transmitted location information and persistent 
identifiers from users of child-directed apps without complying with COPPA); Complaint, FTC and the State of 
New York v. Google LLC and YouTube, LLC, Case No. 1:19-cv-2642 (D.D.C. Sept. 4, 2019) (alleging that YouTube 


persistent identifiers used to target advertising to children.° Since that time, companies’ 
information collection practices have continued to become more extensive, and concerns remain 
that children’s information may be used to target them. 


Concerns about data collection are particularly acute in the school context, where 
children and parents often have to engage with ed tech tools in order to participate in a variety of 
school-related activities. School-issued personal computing devices and online learning services 
have provided substantial benefits to students, particularly as the COVID-19 pandemic closed 
schools and forced families to switch from in-person to remote learning for their children. At the 
same time, parents may have reasonable questions and concerns about the personal information 
that ed tech providers collect and how they use and potentially share that information with third 
parties, including for marketing purposes. And parent groups, among others, have expressed 
concern that children are a captive audience in the school setting and should not be targeted with 
advertising as they pursue their educations.’ School-issued devices and applications also enter 
families’ homes, potentially allowing for even more private information to be collected and 
shared. Commission staff has provided extensive guidance® on COPPA’s application to ed tech 
providers to address these concerns. 


In investigating potential violations of COPPA by providers of ed tech and other covered 
online services, the Commission intends to scrutinize compliance with the full breadth of the 
substantive prohibitions and requirements of the COPPA Rule and statutory language. In 
particular, the Commission will focus on: 


e Prohibition Against Mandatory Collection: COPPA-covered companies, including ed 
tech providers, must not condition participation in any activity on a child disclosing more 
information than is reasonably necessary for the child to participate in that activity.? 
These businesses cannot stop students from engaging in an ed tech activity if they do not 
provide information beyond what is reasonably needed to administer the students’ 


collected persistent identifiers used for targeted advertising from users of child-directed channels without complying 
with COPPA); Complaint, United States v. InMobi Pte Ltd., Case No. 3:16-cv-3474 (N.D. Cal. June 22, 2016) 
(alleging that mobile advertising network collected geolocation information from users of apps directed to children 
under the age of 13 without complying with COPPA). 

© 78 Fed. Reg. 3,972, 4,009. See also Complaint, United States v. HyperBeard, Inc., Case No. 3:20-cv-3683 (N.D. 
Cal. June 3, 2020) (alleging that app developer allowed third-party ad networks to use persistent identifiers to track 
users of its child-directed apps without complying with COPPA); Complaint, FTC and the State of New York v. 
Google LLC and YouTube, LLC, Case No. 1:19-cv-2642 (D.D.C. Sept. 4, 2019); Complaint, United States v. Retro 
Dreamer, Case No. 5:15-cv-2569 (C.D. Cal. Dec. 17, 2015) (alleging that app developer allowed third-party 
advertisers to collect persistent identifiers through its child-directed apps without complying with COPPA); 
Complaint, United States v. LAI Sys., LLC, Case No. 2:15-cv-9691 (C.D. Cal. Dec. 17, 2015). 

T See, e.g., COPPA Rule Review, FTC-2019-0054 (Project No. P195404), Comments of Campaign for a 
Commercial-Free Childhood, et al., Comment No. 117343, at 8 (Dec. 11, 2019) (“In many cases, parents and 
students are not even aware of what data is being collected, why it is being collected, who is collecting it, or where it 
is being stored. This data is often used to build behavioral profiles that allow third parties to create more effective 
marketing campaigns, targeted advertisements, and, ultimately, psychological manipulation of other children.”’). 

8 See Complying with COPPA: Frequently Asked Questions, FED. TRADE COMM’N (July 2020) § N, 
https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked- 

questions#N.%20COPPA %20AND%20SCHOOLS. 

° 16 C.F.R. § 312.7. See also Complaint, United States v. Looksmart Ltd., Civ. Action No. 01-606-A (E.D. Va. Apr. 
19, 2001); Complaint, United States v. BigMailbox.com, Inc., Civ. Action No. 01-605-A (E.D. Va. Apr. 19, 2001). 
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participation in the activity.'° For example, if an ed tech provider does not reasonably 
need to be able to email students, it cannot condition the student’s access to schoolwork 
on students providing their email addresses.'! Students must not be required to submit to 
unnecessary data collection in order to do their schoolwork. 


e Use Prohibitions: COPPA-covered companies, including ed tech providers, are strictly 
limited in how they can use the personal information they collect from children. For 
example, operators of ed tech that collect personal information pursuant to school 
authorization!” may use such information only to provide the requested online education 
service. In this context, ed tech companies are prohibited from using such information for 
any commercial purpose, including marketing, advertising, or other commercial purposes 
unrelated to the provision of the school-requested online service. 


e Retention Prohibitions: COPPA-covered companies, including ed tech providers, must 
not retain personal information collected from a child longer than reasonably necessary to 
fulfill the purpose for which it was collected.!* It is unreasonable, for example, for an ed 
tech provider to retain children’s data for speculative future potential uses. 


e Security Requirements: COPPA-covered companies, including ed tech providers, must 
have procedures to maintain the confidentiality, security, and integrity of children’s 
personal information.!> For example, even absent a breach, COPPA-covered ed tech 
providers violate COPPA if they lack reasonable security.'® 


Such limitations on collection, use, and retention, along with security requirements, place 
significant responsibility on COPPA-covered businesses to implement strong privacy 
protections, in addition to the notice and consent requirements of the COPPA Rule. The 
responsibility for COPPA compliance is on businesses, not schools or parents—and agreements 
must reflect that. 


‘0 The text of the COPPA Rule addressing prohibitions against conditioning access (16 C.F.R. § 312.7), which is 
described here, restates nearly verbatim the text of the statutory language (15 U.S.C. § 6502(b)(1)(©)). As part of its 
ongoing rule review, the Commission is carefully analyzing this provision to ensure that operators are aware of their 
obligations. See Request for Public Comment on the Federal Trade Commission’s Implementation of the Children’s 
Online Privacy Protection Rule, 64 Fed. Reg. 35,842, 35,846 (July 25, 2019). 

! See Children’s Online Privacy Protection Rule, 64 Fed. Reg. 22,750, 22,758 (proposed Apr. 27, 1999) (codified at 
16 C.F.R. § 312) (discussing email address example). 

? Children’s Online Privacy Protection Rule, 64 Fed. Reg. 59,888, 59,903 (Final Rule released Nov. 3, 1999) 
(codified at 16 C.F.R. § 312). 

3 Complying with COPPA: Frequently Asked Questions, FED. TRADE COMM’N § N, https://www.ftc.gov/business- 
guidance/resources/complying-coppa-frequently-asked-questions#N.%20COPPA %20AND%20SCHOOLS (last 
visited May 18, 2022). 

416C.F.R. § 312.10. See also Complaint, United States v. Kurbo, Inc. and WW Int'l, Inc., No. 3:22-cv-00946 (N.D. 
Cal. Feb. 16, 2022). Complaint, United States v. Musical.ly, Case No. 2:19-cv-1439 (C.D. Cal. Feb. 27, 2019). 

515 U.S.C. § 6502(b)(1)(D); 16 C.F.R. § 312.8. See also Complaint, In re Retina-X Studios, LLC, FTC File No. 
1723118 (Mar. 26, 2020). Complaint, United States v. Unixiz, Inc. d/b/a/ iDressup.com, No. 5:19-cv-02222-NC 
(N.D. Cal. April 24, 2019); Complaint, United States v. VTech Elecs. Ltd., Case No. 1:18-cv-114 (N.D. Ill. Jan. 8, 
2018); Complaint, United States v. RockYou, Inc., No 3:12-cv-01487-SI (N.D. Cal. Mar. 26, 2012). 

© 16C.FR. § 312.10. 











Children should not have to needlessly hand over their data and forfeit their privacy in 
order to do their schoolwork or participate in remote learning, especially given the wide and 
increasing adoption of ed tech tools. Going forward, the Commission will closely scrutinize the 
providers of these services and will not hesitate to act where providers fail to meet their legal 
obligations with respect to children’s privacy. 


